COMP3001 Technology Management & Professional Issues:

Project Management

Risk ManagementLecture 9

Graham Collins, UCL

graham.collins@ucl.ac.uk

Risks mentionedRisks mentioned

Lack of appropriate communication to client Lack of ‘buy-in’ Delivering the project, on time on budget to the required

performance can still result in the project being considered a failure

Scope creep, the project may be delayed and over budget Lack of understanding of the requirements, how the work fits

into the wider picture (WBS) or how this links into the process (the series of linked development stages) or life-cycle, the main phases of the project

Lack of understanding of progress Lack of understanding of capability, the individual, team or the

organisation Sometimes it is useful to categorise risks using a framework

mentioned PESTEL, otherwise categories of risks may be ignored

As with metrics, it is useful to keep data and discuss in a review session.

Discounting future performance measuresDiscounting future performance measures

Poor communication Lack of technical understanding Intrinsic uncertainty Different interpretations Different assumptions Multitude of variables Problem compounded by linking to

options

Plotting V as a function of DPlotting V as a function of D

deferral is the preferred choice

proceed now is the preferred choice

D, the real discount rate642

2000

0

-2000

-10 000

-8 000

Based on Chris Chapman & Stephen Ward, Managing Project Risk and Uncertainty: A Constructively Simple Approach to Decision Making, John Wiley 2002.

Uncertainty about cash flows can be examined using sensitivity analysis on a few key variables

V, the value of deferral less proceed now cash flows

M_o_R Strategic framework for the Management of RiskM_o_R Strategic framework for the Management of Risk

Define a framework

Identify the risks

Identify probable risk owners

Evaluate the risks

Set acceptable levels of risk tolerance

Identify suitable responses to risk

Implement responses

Gain assurances about effectiveness

Embed and review

Based on: Management of Risk: Guidance for Practitioners, OGC, HMSO,2002 originally adapted from the HM Treasury Orange Book

Definitions from M_o_RDefinitions from M_o_R

Risk - uncertainty of outcome (whether a positive or negative threat). It is the combination of the chance of an event and its consequences

Risk management – the task of ensuring that the organisation makes cost effective use of a risk process. Risk management requires: processes in place to monitor risks; access to reliable up to date information about risk; the right balance of control in place to deal with those risks; decision making processes supported by a framework of risk analysis and evaluation.

Risk register – a product used to maintain information on all the identified risks pertaining to a particular activity (project or programme)

Risk appetite – the amount of risk the organisation is prepared to tolerate (be exposed to) at any point in time.

Risk Management - StagesRisk Management - Stages

1. Risk awareness2. Risk identification3. Risk owner identification4. Qualitative assessment5. Quantification of probability6. Quantification of impact (severity)7. Exposure rating8. Mitigation9. Contingency provision10. Risk register11. Software usage (if any)12. Monitoring and reporting

Based on Albert Lester, Project Planning and Control, third edition, Butterworth-Heinemann, 2000

Risk Profile ModelsRisk Profile Models

The project profile model www.ogc.gov.uk

Unacceptable risks

Acceptable risks

Impact (effect)

L M H

Risk tolerance line

L

M

H

Typically this grid incorporates, categories VL and VH on both scales

Probability

Status flagsStatus flags

Status flags may also be used. Identified in terms of red/amber/green (or RAG status)

The use of RAG status can be useful for incorporating the status reporting from risk registers into the risk profiles

Measure of risk RAG status, reflects the level of exposure that the risk represents to the project

Action RAG status, reflects the effectiveness of the action applied to the risk.

Risk registerRisk register

Probability Risk reduction strategy

Contingency plans

Risk owner

Based on A. Lester, ibid. Other categories could be added i.e. trigger, (which would be synonymous to input in a process diagram) or proximity indicating which phase the risk is likely to occur.

Reference: ………..... Date: …………………Prepared by: ……………..

Project: ……………………………….. Key: H – High; M – Medium; L - LowType of Risk

Description of Risk H M L Perf. Cost Time

Impact

Solar heating exerciseSolar heating exercise

Please work in pairs

You are the owner of a semi-detached house (your partner in the exercise owns the adjacent property)

You decide to replace part of the roof with solar panels to save on your hot water heating bill. Identify the risks involved in this project, and ways in which you could manage each of these risks.

I hope to display some of your ideas for the class to discuss, after 10 minutes.

Risk ManagementRisk Management

Risk Probability Impact

Insufficient number of skilled OO developers

H H

Demo not ready for OOP conference Munich

M H

Then develop a management plan on wall, ie risk, actions, owner, status

Visible modelsVisible models

Risk Actions Owner Status…

Insufficient number of skilled object-oriented developers; thus slow development and poor design

The key concept is to keep the models such as the risk register (here it is the risk list with associated actions and status) as visible as possible, using whiteboards on the wall of the project room, and then transfer via digital camera to a Wiki web-page (project web-page).

Proactive Hire temporary consultants Design and program in pairs Classroom education and mentoring

Personal viewPersonal view

Shared responsibility for risk i.e. the team are responsible for risk reporting (as well as joint planning, estimating, reporting progress and sharing the rewards).

Where possible teams of two are not only involved in co-development (pair programming) but

also keeping track of each others progress in a supportive manner as well as tracking risks specific to their tasks as well as the risks they have volunteered to own.

(In addition effort is sometimes placed on identification of risks which are then not adequately tracked and managed. Another area that is important is that risk often cannot easily be quantified, they often have a profile, hence Monte Carlo software simulations are important for understanding and interpreting risks.)

EnvironmentEnvironment

Continuous integration Project Wiki webs Reverse engineering- Somatik Caves, walls, digital technology

Risk Concept Map for Euro changeover projectRisk Concept Map for Euro changeover project

Bank customer dissatisfaction

Risk of litigation

Risk of mis-dispense if

notes not robust

Banks could run out of cash in certain areas

Replacement may be a problem

On premise storage

Demand will be unusually high

Changeover is in a holiday period

Planned branch opening times

may be impacted

Potential widespread ATM downtime

Potential for help desk call surge

Based on a NCR project, Euro changeover project for automated teller machines, John Barlett, Managing Risk for Projects and Programmes, Project Manager Today, 2002

Risk situation

Impact

Risk driver

Assumption

R1

R2

Risk number related to registerR2

Case Study- Data Intelligence Case Study- Data Intelligence

‘Alongside monitoring the vast amounts of e-mail…the RBS Group records and stores other types of unstructured content including digital voice calls made in its dealing rooms, for regulatory purposes.’

Apart from the need to guard against fraud, there is a need to ‘store information for compliance, litigation and e-discovery requirements’.

“It is about the quality of information capture – whether customer details or financial transactions – as a function of risk control and risk management,” David Kemp RBS legal department.

From:

‘Harnessing data intelligence for future growth, (Case Study Royal Bank of Scotland Group) Information Management guide

Martin Courtney,

Computing 22 January 2009